osquery (Linux)

License or service

osquery (Apache 2.0 / GPL 2.0 dual)

What is free

All

What costs

Nothing

Vendor page

https://github.com/osquery/osquery

As read on

2026-11-01

A vendor statement as read on the date shown; the cost class is the durable part.

• T1003.005 Cached Domain Credentials
• T1011.001 Exfiltration Over Bluetooth
• T1014 Rootkit
• T1027.001 Binary Padding
• T1027.005 Indicator Removal from Tools
• T1027.006 HTML Smuggling
• T1027.008 Stripped Payloads
• T1027.009 Embedded Payloads
• T1027.010 Command Obfuscation
• T1027.011 Fileless Storage
• T1036 Masquerading
• T1036.002 Right-to-Left Override
• T1036.003 Rename Legitimate Utilities
• T1036.004 Masquerade Task or Service
• T1036.005 Match Legitimate Resource Name or Location
• T1036.008 Masquerade File Type
• T1036.010 Masquerade Account Name
• T1037 Boot or Logon Initialization Scripts
• T1053 Scheduled Task/Job
• T1053.006 Systemd Timers
• T1055.008 Ptrace System Calls
• T1055.009 Proc Memory
• T1055.014 VDSO Hijacking
• T1057 Process Discovery
• T1059.004 Unix Shell
• T1070.006 Timestomp
• T1114 Email Collection
• T1120 Peripheral Device Discovery
• T1125 Video Capture
• T1205.002 Socket Filters
• T1222.002 Linux and Mac Permissions
• T1480.001 Environmental Keying
• T1543.002 Systemd Service
• T1547.006 Kernel Modules and Extensions
• T1547.013 XDG Autostart Entries
• T1560.003 Archive via Custom Method
• T1564.013 Bind Mounts
• T1571 Non-Standard Port
• T1572 Protocol Tunneling
• T1573 Encrypted Channel
• T1573.001 Symmetric Cryptography
• T1573.002 Asymmetric Cryptography
• T1574 Hijack Execution Flow
• T1574.006 Dynamic Linker Hijacking
• T1574.007 Path Interception by PATH Environment Variable
• T1686 Disable or Modify System Firewall
• T1690 Prevent Command History Logging